Privacy Policy

1. Introduction

This Privacy Policy describes how Kaari ("we", "us", "our") collects, uses, discloses, and protects your personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using our website or placing an order, you consent to the practices described in this policy.

2. Data We Collect

We collect the following categories of personal data:

Identity: Name, email address, phone number
Address: Shipping and billing address
Order data: Order history, product preferences, payment method
Communication: Messages sent via WhatsApp, email, or our contact form
Usage data: Pages visited, device type, IP address (for order fraud prevention only)

We do not collect or store your credit card, debit card, UPI PIN, or bank account details. All payment data is handled directly by Cashfree, our PCI-DSS compliant payment gateway.

3. Purpose of Data Processing

We process your personal data for the following purposes:

To process and deliver your orders
To communicate order updates, shipping notifications, and support requests
To send occasional updates about new collections (only if you explicitly subscribe)
To prevent fraud and ensure the security of transactions
To comply with legal and tax obligations

Processing of your personal data for order fulfilment is based on the performance of a contract. Processing for marketing communications requires your explicit consent, which you may withdraw at any time.

4. Consent

Under the DPDP Act, your consent must be free, specific, informed, and unambiguous. When you place an order, you provide consent for us to process your personal data for the purposes listed above. You may withdraw consent at any time by contacting our Grievance Officer. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

For non-essential cookies (analytics), we present a cookie consent banner on first visit. Essential cookies (cart, authentication) are necessary for the site to function and cannot be disabled.

5. Data Sharing

We share your personal data only with trusted third parties necessary to fulfil your order:

Cashfree: Payment processing (PCI-DSS compliant)
Courier partners: Shipping address and phone number for delivery
Supabase: Database hosting and authentication (ISO 27001 certified)

We do not sell, rent, or trade your personal information to any third party for marketing purposes. We may disclose data to government authorities if required by law.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Orders: 7 years (tax and audit requirement under Indian law)
Contact messages: 3 years
Carts and wishlists: 30 days to 1 year of inactivity
Newsletter subscriptions: Until you unsubscribe (or 3 years)

After the retention period, order data is anonymized and other data is permanently deleted via an automated daily cleanup process.

7. Data Principal Rights

Under the DPDP Act, you (as a "Data Principal") have the following rights:

Right to Access: Request a copy of the personal data we hold about you
Right to Correction: Ask us to correct inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data, subject to legal obligations
Right to Withdraw Consent: Withdraw consent for data processing at any time
Right to Grievance Redressal: File a complaint with our Grievance Officer
Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity

To exercise any of these rights, please contact us at grievance@kaarihandmade.com or visit the Data Rights section in your account.

8. Grievance Officer

In accordance with Section 31 of the DPDP Act, Kaari has appointed a Grievance Officer to address complaints regarding the handling of your personal data:

Name: Roshan Khatri
Email: grievance@kaarihandmade.com
Phone: +91 9131548788

Grievances will be acknowledged within 48 hours and resolved within 30 days.

9. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Row-level security (RLS) policies on all database tables
Encrypted connections (HTTPS/TLS) for all data transmission
Payment data handled exclusively by PCI-DSS compliant Cashfree
Supabase authentication with JWT-based session management
Automated data retention and anonymization

For more details, please see our Security Policy.

10. Children's Data

We do not knowingly collect personal data from children under 18 years of age. If you believe a child has provided us with personal data, please contact our Grievance Officer, and we will take steps to delete such data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related inquiries, please email us at hello@kaarihandmade.com or contact our Grievance Officer at grievance@kaarihandmade.com.